1 8th  ICCRTS 


“C2  in  Underdeveloped,  Degraded  and  Denied  Operational  Environments” 


Enabling  Efficient  Intelligence  Analysis 
in  Degraded  Environments 


Topic  3:  Data,  Information  and  Knowledge 

Regine  Lecocq* 

Valerie  Lavigne 
Defence  Scientists 

Defence  R&D  Canada  -  Valcartier 
2459  Pie-XI  North,  Quebec  City,  QC,  G3J  1X5,  Canada 
Phone:  1  (418)  844  4000  Fax:  1  (418)  844  4538 
Email :  F irstname .  Sumame@drdc-rddc . gc . ca 


(*):  Point  of  contact  author 
E-mail:  Reginedecocq@drdc-rddc.gc.ca 


Report  Documentation  Page 


Form  Approved 
OMB  No.  0704-0188 


Public  reporting  burden  for  the  collection  of  information  is  estimated  to  average  1  hour  per  response,  including  the  time  for  reviewing  instructions,  searching  existing  data  sources,  gathering  and 
maintaining  the  data  needed,  and  completing  and  reviewing  the  collection  of  information.  Send  comments  regarding  this  burden  estimate  or  any  other  aspect  of  this  collection  of  information, 
including  suggestions  for  reducing  this  burden,  to  Washington  Headquarters  Services,  Directorate  for  Information  Operations  and  Reports,  1215  Jefferson  Davis  Highway,  Suite  1204,  Arlington 
VA  22202-4302.  Respondents  should  be  aware  that  notwithstanding  any  other  provision  of  law,  no  person  shall  be  subject  to  a  penalty  for  failing  to  comply  with  a  collection  of  information  if  it 
does  not  display  a  currently  valid  OMB  control  number. 


1.  REPORT  DATE 

JUN  2013 


2.  REPORT  TYPE 


3.  DATES  COVERED 


00-00-2013  to  00-00-2013 


4.  TITLE  AND  SUBTITLE 


Enabling  Efficient  Intelligence  Analysis  in  Degraded  Environments 


5a.  CONTRACT  NUMBER 


5b.  GRANT  NUMBER 


6.  AUTHOR(S) 


5c.  PROGRAM  ELEMENT  NUMBER 


5d.  PROJECT  NUMBER 


5e.  TASK  NUMBER 


5f.  WORK  UNIT  NUMBER 


7.  PERFORMING  ORGANIZATION  NAME(S)  AND  ADDRESS (ES)  8.  PERFORMING  ORGANIZATION 

Defence  R&D  Canada  ?  Valcartier,2459  Pie-XI  North, Quebec  City,  QC,  REPORT  NUMBER 
G3J  1X5,  Canada, 

9.  SPONSORING/MONITORING  AGENCY  NAME(S)  AND  ADDRESS(ES)  10.  SPONSOR/MONITOR’S  ACRONYM(S) 

11.  SPONSOR/MONITOR’S  REPORT 
NUMBER(S) 

12.  DISTRIBUTION/AVAILABILITY  STATEMENT 

Approved  for  public  release;  distribution  unlimited 

13.  SUPPLEMENTARY  NOTES 

Presented  at  the  18th  International  Command  &  Control  Research  &  Technology  Symposium  (ICCRTS) 
held  19-21  June,  2013  in  Alexandria,  VA.  U.S.  Government  or  Federal  Rights  License 

14.  ABSTRACT 

When  facing  decisions  in  underdeveloped,  degraded  and  denied  environments,  the  commanders  are  likely 
to  rely  even  more  heavily  on  efficient  intelligence  analysis.  Unfortunately,  most  of  the  time,  the  data 
gathered  in  these  environments  will  be  uncertain,  ambiguous  and  incomplete.  Tools  enabling  fast  and 
thorough  analysis  are  thus  required.  Use  of  automated  processing  alone  is  vulnerable  to  data  deficiencies 
and  human  judgment  is  essential  to  ensure  intelligence  products  validity.  Interactive  visual  interfaces  offer 
a  strong  approach  for  enabling  human  analysis  by  leveraging  the  high  bandwidth  visual  pathway  into  the 
human  mind  and  unique  human  visual  pattern  finding  abilities.  We  proposed  visual  analytics  tools  to 
support  sensemaking  and  improve  social  network  analysis  in  a  counter-insurgency  context.  Our  prototype 
is  composed  of  a  series  of  independent  but  coordinated  generic  widgets  that  can  be  applied  to  a  broad 
range  of  application  domains.  Among  the  proposed  analysis  tools  are:  a  Multi-timelines  widget  for 
temporal  events  and  situation  evolution  analysis;  a  Magnets  Grid  widget  for  multidimensional  information 
exploration;  and  a  record  browser  of  Visual  Summary  Cards  widget  for  fast  visual  identification  of  key 
information  elements  and  comparison  between  entities.  We  also  expose  the  concepts  underlying  an 
additional  widget  currently  in  definition.  The  Graph  Analytics  widget  combines  a  visual  presentation  of 
graph  diagrams  composed  of  nodes  and  links  to  other  visual  presentations  of  the  analyses  outputs  like 
ranking,  statistical  results  or  else  the  semantic  meaning  of  links  based  on  a  social  network  ontology. 


15.  SUBJECT  TERMS 


16.  SECURITY  CLASSIFICATION  OF: 

17.  LIMITATION  OF 

18.  NUMBER 

19a.  NAME  OF 

ABSTRACT 

OF  PAGES 

RESPONSIBLE  PERSON 

a.  REPORT 

unclassified 

b.  ABSTRACT 

unclassified 

c.  THIS  PAGE 

unclassified 

Same  as 
Report  (SAR) 

43 

Standard  Form  298  (Rev.  8-98) 

Prescribed  by  ANSI  Std  Z39-18 


1  Abstract 


When  facing  decisions  in  underdeveloped,  degraded  and  denied  environments,  the 
commanders  are  likely  to  rely  even  more  heavily  on  efficient  intelligence  analysis. 
Unfortunately,  most  of  the  time,  the  data  gathered  in  these  environments  will  be 
uncertain,  ambiguous  and  incomplete.  Tools  enabling  fast  and  thorough  analysis  are  thus 
required.  Use  of  automated  processing  alone  is  vulnerable  to  data  deficiencies  and  human 
judgment  is  essential  to  ensure  intelligence  products  validity.  Interactive  visual  interfaces 
offer  a  strong  approach  for  enabling  human  analysis  by  leveraging  the  high  bandwidth 
visual  pathway  into  the  human  mind  and  unique  human  visual  pattern  finding  abilities. 
We  proposed  visual  analytics  tools  to  support  sensemaking  and  improve  social  network 
analysis  in  a  counter-insurgency  context.  Our  prototype  is  composed  of  a  series  of 
independent  but  coordinated  generic  widgets  that  can  be  applied  to  a  broad  range  of 
application  domains.  Among  the  proposed  analysis  tools  are:  a  Multi-timelines  widget  for 
temporal  events  and  situation  evolution  analysis;  a  Magnets  Grid  widget  for  multi¬ 
dimensional  information  exploration;  and  a  record  browser  of  Visual  Summary  Cards 
widget  for  fast  visual  identification  of  key  information  elements  and  comparison  between 
entities.  We  also  expose  the  concepts  underlying  an  additional  widget  currently  in 
definition.  The  Graph  Analytics  widget  combines  a  visual  presentation  of  graph  diagrams 
composed  of  nodes  and  links  to  other  visual  presentations  of  the  analyses  outputs  like 
ranking,  statistical  results  or  else  the  semantic  meaning  of  links  based  on  a  social  network 
ontology. 

2  Introduction 

The  context  of  military  operations  has  changed  significantly  since  the  end  of  the  Cold 
War  and  into  the  Global  War  on  Terror.  For  instance,  military  forces  are  now  faced  with 
an  elusive  and  changing  adversary  who  is  technologically  innovative.  Multiple  theatres  of 
operations  have  to  be  considered  and  operations  must  be  conducted  in  a  Joint, 
Interagency,  Multinational  and  Public  (JIMP)  environment.  Table  1  depicts  some 
elements  of  the  new  context,  which  create  such  a  degraded  and  denied  environment  for 
our  military  forces. 


Table  1:  Context  of  new  military  operations  [DLCD,  2009] 


Cold  War  Context 

New  Military  Context 

Well  defined  strategic  context  (Cold  War) 

Poorly  defined  strategic  context  (Global  War  on  Terror) 

Static  theatre  of  operations 

Multiple  theatres  of  operations 

Single  spectrum  operation 

Full  spectrum  engagement 

Well  defined  adversary 

Elusive  and  changing  adversary 

Technologically  predictable  enemy 

Technologically  innovative  enemy 

Structured  enemy  forces 

Networked  enemy  forces 

Corps  construct 

Battle  group  construct 

Rigid  and  concentrated  forces 

Adaptable  and  dispersed  forces 

Long  term  evolution  cycle 

Very  short  term  evolution  cycle 

Limited  third  party  considerations 

Crowded  JIMP  environment 

Controlled  info  sphere 

Uncontrollable  info  sphere 
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The  Canadian  Forces  (CF)  and  the  allies  have  been  increasingly  involved  in  missions 
taking  place  in  this  new  context  of  operation.  The  commanders  having  to  proceed  to 
decision  making  in  such  context  rely  more  heavily  on  efficient  intelligence  analyses. 

The  intelligence  function  itself,  along  with  its  complex  tasks,  is  also  impacted  by  the 
complexity  of  the  environment.  For  instance,  the  context  of  counter-insurgency  (COIN), 
under  which  this  research  project  is  taking  place,  is  bringing  its  own  additional 
components  of  complexity.  With  respect  to  the  term  “insurgency”,  the  CF  COIN  doctrine 
[DND/CF  2008]  defines  it  as  being  “a  part  of  a  wider  set  of  irregular  activities  and  threats 
to  a  secure  and  stable  environment”.  An  “irregular  activity”  may  be  defined  as: 
“behaviour  that  attempts  to  affect  or  prevent  change  through  the  illegal  use,  or  threat,  of 
violence,  conducted  by  ideologically  or  criminally  motivated  non-regular  forces,  groups 
or  individuals,  as  a  challenge  to  authority”.  While  insurgent  groups  can  be  tightly 
connected  to  criminal  or  terrorist  networks  [Lonsdale  2008],  their  motivation  is  different 
as  it  is  initially  a  political  one  expressed  through  oppositions  to  the  government  in  place 
or  any  instance  supporting  it.  These  definitions  stress  some  essential  elements.  First  they 
refer  to  asymmetric  approaches  by  opposition  to  the  conventional  threats  that  were 
known  up  to  the  cold  war  period1 2.  Second,  they  clearly  position  the  importance  of  gaining 
local  population  support  as  the  fundamental  objective  of  such  warfare  from  both  the 
insurgents  as  well  as  the  military  forces  standpoints.  This  implies  that  the  line  between 
the  local  population  and  the  adversaries  is  blurred.  In  essence,  an  insurgency  emerges 
from  inside  a  country,  and  the  insurgents  networks  are  usually  embedded  in  local 
communities.  Therefore,  making  sense  of  the  situation  requires  not  only  understanding 
the  insurgent  networks,  but  also  their  connections  to  other  networks  like  the  criminal  or 
terrorist  networks  as  well  as  the  local  population  networks.  This  would  then  include  a 
certain  level  of  white  situation  awareness  (SA)  partly  accessible  through  social  network 
analysis  techniques  and  methods.  Such  difficulties  in  understanding  these  systems  and 
how  each  part  impact  on  one  another  are  exacerbated  by  the  cultural  differences  between 
the  local  communities  and  the  military  personnel. 

3  An  intelligence  SNA  capability 

3.1  Sensemaking  and  SNA 

The  concept  of  sensemaking  is  central  to  the  military  domain  and  tightly  connected  to 
situation  awareness.  Sensemaking  can  be  understood  as  “a  process  to  successively  build 
and  refine  representations  and  fit  data  with  representations  to  meet  the  requirements  of  a 
task”  [Russell  et  al.  1993].  The  process  described  by  Russell  et  al.  [1993]  envisions 
sensemaking  as  the  quest  for  successive  representation  that  best  support  the  task  to  be 
performed.  This  perspective  on  sensemaking  was  more  deeply  explored  in  the  context  of 
intelligence  analysis  activities  by  Pirolli  and  Card  [2005]  with  their  “Notional  model  of 
sensemaking  loop  for  intelligence  analysis”  depicted  in  Figure  1. 


1  See  Table  1 :  Context  of  new  military  operations  [DLCD,  2009] 

2  White  situational  awareness  includes  things  such  as  infrastructure  analysis  (e.g.  buildings,  lines  of 
communications)  and  population  analysis  (political,  economic,  cultural  (ethnic/racial/tribal/religious),  education, 
health,  welfare,  language,  history  and  key  personalities). 
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Figure  1.  Notional  model  of  sensemaking  loop  for  intelligence  analysis  [Pirolli  and  Card  2005] 

As  exposed  in  Pirolli  and  Card’s  model,  in  order  to  achieve  sensemaking,  many  different 
tasks  are  required  to  be  performed,  each  one  supported  by  some  types  of  representations. 
Furthermore,  these  tasks  are  considered  as  complex  ones  and  in  essence  they  differ  from 
well-structured  tasks  in  several  ways.  During  the  Computer  Human  Information  (CHI) 
2008  Workshop  on  Sensemaking,  Scholtz  [2008]  summarized  these  differences  discussed 
in  Redish  [2007]  and  Redish  and  Scholtz  [2007]: 

•  “Information  overload  is  endemic.  People  have  to  locate  the  relevant 
information/sources  and  focus  only  on  those. 

•  Data  analysis  and  recursive  decision-making  are  cognitively  very  burdensome; 
people  have  little  cognitive  workload  available  for  dealing  with  unusable 
interfaces. 

•  Information  is  often  incomplete  or  even  unreliable. 

•  In  some  domains,  there  may  be  no  way  to  know  if  the  result  one  gets  is  right  or 
wrong. 

•  In  many  domains  time  may  be  critical.  Good  decisions  made  too  late  are  bad 
decisions. 

•  Domain  experts  may  not  be  computer  experts.  The  demands  of  their  work  may 
make  it  difficult  for  them  to  put  much  time  or  effort  into  the  learning  curve  of  new 
programs. 
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•  Software  systems  for  complex  problem  solving  often  consist  of  several 
components  and  visualizations.  We  must  evaluate  the  individual  components 
and/or  visualizations  as  well  as  the  entire  system. 

•  Information  for  many  of  these  tasks  is  not  static  but  changes  over  time.  This 
dynamic  nature  increases  the  complexity  of  the  task. 

•  Complex  problems  often  require  multiple  domain  experts  to  collaborate.  This 
presents  a  challenge  in  combining  multiple  perspectives.” 

In  the  counter-insurgency  context  or  other  ones  strongly  related  to  socio-cultural  aspects, 
when  an  intelligence  analyst  attempts  to  make  sense  of  the  situation  by  conducting  these 
tasks,  some  of  the  required  pieces  of  information  can  be  extracted  by  analyzing  social 
networks  .  Tools  enabling  fast  and  thorough  social  network  analysis  are  thus  required. 
However,  use  of  automated  processing  alone  is  vulnerable  to  data  deficiencies  and  human 
judgment  is  essential  to  ensure  intelligence  products  validity.  Interactive  visual  interfaces 
offer  a  strong  approach  for  enabling  human  analysis  by  leveraging  the  high  bandwidth 
visual  pathway  into  the  human  mind  and  unique  human  visual  pattern  finding  abilities. 
Therefore,  we  proposed  visual  analytics  tools  to  support  sensemaking  and  improving 
social  network  analysis  in  a  counter-insurgency  context. 

3.2  Social  network  analysis  research  project 

It  is  with  this  perspective  in  mind  that  DRDC  has  started  to  research  on  SNA  for  the 
benefit  of  the  DND/CF.  In  2010,  a  new  applied  research  project  called  “Social  Network 
Analysis  in  Counterinsurgency”  (SNAC)  has  started3 4.  It  relies  on  the  premise  that 
improving  intelligence  products  through  advanced  SNA  and  visualisation/interaction  will 
contribute  to  increase  sensemaking  and  situation  awareness  leading  to  better  decision 
making  [Lecocq  et  al  2011],  From  a  social  sciences  perspective,  SNA  can  support  the 
intelligence  function  through  a  better  understanding  of  the  social  networks,  their 
structures,  and  how  to  best  influence  or  else  weaken  them  in  the  case  of  insurgent 
networks. 

While  existing  tools  and  technologies  will  be  investigated,  the  current  research  project 
aims  at  identifying  and  enabling  the  different  components  of  a  full  SNA  capability.  SNA 
cannot  be  summarized  as  the  sole  use  of  technologies  supporting  the  exploitation  of  some 
SNA  measures  like  the  usual  betweenness  centrality,  and  a  few  others.  An  intelligence 
SNA  capability  requires  enlarging  the  scope  to  include  the  activities  to  be  performed 
prior  and  after  the  analysis  itself. 

3.2. 1  Social  network  analysis  capability  framework 

As  depicted  in  Figure  2,  the  starting  point  of  the  intelligence  SNA  capability  will  be 
defined  by  the  military  needs  based  on  the  COIN  strategy  and  its  underlying  objectives 
(1).  These  latest,  combined  to  the  desired  effects  pursued  by  the  militaries,  will  permit  to 
identify  more  precisely  the  social  networks  of  interest  and  the  analyses  to  be  performed 


3  Unfortunately,  as  underlined  by  Gou  et  al.  [2012],  existing  social  network  analysis  tools  often  overlook  users’ 
needs  for  sensemaking  activities  that  help  to  gather,  synthesize,  and  organize  information  about  the  social  data. 

4  For  more  details  on  the  SNAC  project  please  refer  to  Lecocq,  Lavigne  and  Gouin  [2011]. 
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on  them  (2).  By  doing  this,  the  analyst  seeks  to  identify  the  variables  involved  in  the 
questions  being  asked. 

In  turn,  once  the  variables  have  been  identified,  it  is  based  on  them  that  meaningful 
datasets  can  be  identified  and  extracted  (3)  in  order  to  represent  the  social  networks  of 
interest  and  perform  the  analysis.  Many  types  of  data  sources  will  be  considered  as  inputs 
to  SNA.  Among  them  will  be  internal  data  sources  as  well  as  sources  already  providing 
social  network  information  in  a  digitized  format  as  for  instance  the  social  networking 
technologies.  The  data  collected  should  first  permit  to  represent  the  social  networks  of 
interest  and  their  significant  features  (4)  and,  second,  initiate  the  related  analysis  (5).  The 
result  of  such  analysis  will  either  specify  the  need  for  further  refinement  of  the  SNA  to  be 
performed  or  else  provide  intelligence  on  SNA  product  (6)  related  to  the  initial  issue 
based  on  the  COIN  objective.  Such  an  intelligence  SNA  product  will  greatly  help  to 
better  understand  the  situation,  but  it  should  also  be  combined  with  additional  relevant 
intelligence  analysis  enabling  to  cover  a  larger  scope  of  the  initial  issue  expressed. 
Overall,  this  will  enhance  the  sensemaking  process  of  the  analysts. 


Counter  Insurgency  objectives  -  INT 


External 

Sources 


HUMINT 

IMINT 

GEO  INT 

SIGINT 

ELINT 

MASINT 

COMINT 

OSINT 

TECHINT 

FIS  INT 

FININT 

Figure  2.  SNA  capability  framework 
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While  the  scope  of  the  project  is  COIN  and  intelligence,  it  is  envisioned  as  a  more 
generic  capability  of  SNA  which  could  be  used  in  different  contexts.  SNA  should  be 
performed  as  a  constant  activity  complementary  to  other  intelligence  analysis  activities. 
Similarly,  while  being  built  for  the  purpose  of  the  intelligence  function,  the  capability  in 
itself  and  its  different  components  should  also  be  transitioned  to  the  command  and 
control  function  and  consequently  achieve  a  more  meaningful  bridge  between  the  two 
functions. 

3.2.2  Visualisation  and  visual  analytics 

In  the  context  of  this  research  project,  analyses  of  social  networks  are  performed  for  the 
benefits  of  the  intelligence  function  and  consequently  in  support  to  decision  making. 
SNA  requires  complex  tasks  holding  the  same  characteristics  than  the  ones  described  by 
Sholtz  [2008]  in  the  previous  section.  Indeed,  the  multiple  dimensions  of  the  information 
and  the  quantity  of  linkages  to  understand  may  lead  to  a  cognitive  overload.  It  is  essential 
to  fully  exploit  the  power  of  information  visualisation. 

Information  visualisation  is  defined  as:  “the  use  of  computer-supported,  interactive, 
visual  representations  of  abstract  data  to  amplify  cognition”  [Card  et  al  1999].  This 
definition  refers  to  two  essential  parts  contributing  to  information  visualisation:  the  first 
is  the  cognitive  ability  of  the  human  to  perceive  and  make  a  mental  representation  of 
information  or  a  situation;  the  second  is  the  supporting  technology  that  allows  the 
presentation  of  this  information  or  situation. 

Information  visualisation  constitutes  a  significant  research  area,  which  studies  various 
human  cognitive  characteristics  such  as  pre-attention  and  inattentional  blindness.  It  also 
explores  and  develops  various  techniques  to  represent  information  in  a  salient  way  and 
provide  efficient  interaction.  “Information  visualisation  promises  to  help  us  speed  our 
understanding  and  action  in  a  world  of  increasing  information  volumes”  [Card  2008], 

More  recently,  Visual  analytics  has  emerged  as  a  multidisciplinary  field  of  research  that 
leverages  information  visualisation  and  a  number  of  other  disciplines.  “Visual  analytics  is 
the  science  of  analytical  reasoning  facilitated  by  interactive  visual  interfaces”  [Thomas 
and  Cook  2005],  Visual  analytics  focuses  on  the  following  areas: 

•  “Analytical  reasoning  techniques  that  enable  users  to  obtain  deep  insights  that 
directly  support  assessment,  planning,  and  decision  making;” 

•  “Visual  representations  and  interaction  techniques  that  take  advantage  of  the 
human  eye’s  broad  bandwidth  pathway  into  the  mind  to  allow  users  to  see, 
explore,  and  understand  large  amounts  of  information  at  once;” 

•  “Data  representations  and  transformations  that  convert  all  types  of  conflicting  and 
dynamic  data  in  ways  that  support  visualisation  and  analysis;” 

•  “Techniques  to  support  production,  presentation,  and  dissemination  of  the  results 
of  an  analysis  to  communicate  information  in  the  appropriate  context  to  a  variety 
of  audiences’  [Thomas  and  Cook  2005].” 
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4  Visualisation  and  SNA 

In  the  context  of  this  project,  we  consider  that  interactive  visual  interfaces  offer  a  strong 
approach  for  enabling  human  analysis  by  leveraging  the  high  bandwidth  visual  pathway 
into  the  human  mind  and  unique  human  visual  pattern  finding  abilities.  We  proposed 
visual  analytics  tools  to  support  sensemaking  and  improve  social  network  analysis  in  a 
counter-insurgency  context.  The  research  team  levered  different  representation  formats 
best  supported  by  visualization  and  visual  analytics  techniques  for  the  development  of  a 
social  network  analysis  capability  as  exposed  in  the  framework.  Here  again,  visual 
analytics  techniques  come  in  support  of  each  component  of  the  framework  and  not  only 
the  analysis  portion.  In  terms  of  complexity,  these  analyses  have  to  encounter  many 
covert  networks,  which  in  essence  are  surreptitious;  making  data  about  them  more 
difficult  to  collect  [Roberts  2010].  The  analyses  of  social  networks  performed  in  this 
context  have  to  take  into  considerations  missing  data  and  the  reliability  of  the  source  the 
data  is  extracted  from.  Actually,  SNA  is  prone  to  numerous  errors,  specifically  due  to 
misunderstandings  about  the  meaning  and  the  quality  of  the  data  supporting  the  analysis. 
In  2011,  a  report  was  published  following  a  workshop  on  the  “challenges  in 
computational  social  modeling  and  simulation  for  national  security  decision-making”. 
The  importance  of  SNA  was  largely  discussed  during  the  workshop  and  Jeffrey  C. 
Johnson5  [2011]  stressed  the  importance  of  developing  a  science  of  errors.  In  the 
prototype,  visualisation  techniques  are  pursued  in  order  to  help  the  analyst  understand  the 
limits  of  the  analysis  in  relation  to  the  data  supporting  it.  In  many  cases,  analysts  need  to 
know  from  which  data  sources  the  data  are  extracted  and  their  reliability.  Also,  the 
analyst  needs  to  be  able  to  grasp  the  extent  to  which  data  are  missing  and  its  impact  on 
the  performed  analysis  of  the  social  network  or  else  to  what  level  the  computed  measure 
is  prone  to  misleading  based  on  missing  data. 

In  a  previous  paper,  Lecocq  et  al  [2011]  looked  at  each  component  of  visualisation  for  the 
full  spectrum  of  the  SNA  prototype  development  in  the  context  of  this  research  project. 
They  mentioned  a  number  of  challenges  they  were  facing  while  attempting  to  develop 
such  a  SNA  capability,  as  well  as  some  important  elements  when  leveraging  visual 
analytics  techniques  and  methods.  To  name  a  few: 

•  Social  networks  analyses  results  should  be  explored  through  combined  visual 
means  and  not  solely  by  presenting  a  graph  diagram  depicting  some  components 
of  the  social  network  structure; 

•  The  analyst  should  benefit  from  sensemaking  tools  in  order  to  understand  the  data 
used  to  characterise  the  social  network  as  well  as  to  perform  analysis  on  it.  This 
implies  the  integration  of  the  semantics  about  the  selected  data  into  the  visual 
analytics  tools.  Other  information  could  also  be  integrated,  as  for  instance,  the 
limitation  of  the  data  set  and  the  corresponding  resilience  of  the  SNA  measures  to 
missing  data; 

•  The  capacity  to  manage  large  amount  of  data  and  visualise  large  graphs  in  a 
meaningful  way  is  required  in  the  context  of  this  research  project; 


5  Paper  presented  at  the  DTRA/Sandia  Workshop  on  Challenges  in  Computational  Social  Science.  Santa  Fe,  New 
Mexico.  October  25-28,  2010 
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•  Visual  analytics  techniques  should  be  carefully  utilized  when  attempting  to 
perform  analyses  of  social  networks  in  a  complex  context  like  a  counter¬ 
insurgency  environment. 

Since  then  a  number  of  elaborations  have  been  performed  and  the  following  section 
describes  four  different  visualisation  widgets  foreseen  to  be  part  of  the  SNA  proof-of- 
concept  prototype.  Each  of  these  widgets  was  implemented  using  Service  Oriented 
Architecture  (SOA)  principles,  providing  them  enough  flexibility  to  be  used  in  different 
contexts  of  operation.  Indeed,  three  of  these  widgets  were  initially  developed  for 
maritime  domain  awareness  purposes  and  are  being  transposed  to  the  COIN  context.  The 
fourth  widget,  the  “Graph  Analytics”  widget,  is  currently  under  definition  and  will  soon 
be  developed  for  the  purpose  of  the  SNAC  research  project.  Likewise  the  first  three 
widgets,  this  one  could  also  be  transposed  to  other  contexts  like  the  maritime  domain  in 
order  to  leverage  graph  analytics  techniques. 

The  fact  that  the  visual  analytics  techniques  are  exploited  through  the  use  of  widgets,  is 
supported  by  several  rationales.  Indeed,  the  intelligence  analysts,  in  the  Canadian  Forces, 
are  not  solely  dedicating  their  time  to  perform  social  network  analysis  alone.  Intelligence 
analysts  have  to  perform  many  different  types  of  analyses,  all  pertaining  to  a  same 
situation  being  faced.  SNA  is  critical  for  some  aspects  but  will  never  hold  the  entire 
solution  in  itself.  Therefore,  in  order  to  reach  a  certain  level  of  sensemaking,  it  is 
important  to  combine  visual  techniques  involving  networks  with  other  ones  like  the 
semantic  of  the  relationship,  the  geographical  information,  the  anomaly  detection,  or  else 
the  time  window  of  interest.  Krempel  [2009]  suggested  that  advanced  visualisation 
techniques  should  be  able  to  help  solving  complex  situations  in  an  efficient  way.  In  our 
situation,  COIN  complex  environments  combined  with  social  data  complexity  necessitate 
providing  the  end-user  with  multiple  types  of  visual  displays.  The  development  under  the 
format  of  composable  widgets  enables  to  select  the  ones  that  are  the  most  relevant  to  a 
specific  situation  and  that  will  enable  the  human  ability  to  rapidly  detect  patterns  and 
reach  sensemaking.  These  widgets  remain  connected  to  one  another,  creating  enough 
flexibility  to  permit  a  shift  of  focus  towards  specific  elements  of  interest  pertaining  to  the 
situation  being  faced. 

4.1  Visual  Summary  Cards  widget 

The  visual  summary  cards  widget  shows  all  the  key  characteristics  of  a  node,  or  so  called 
social  entity  (individual,  group  or  organization),  at  a  single  glance.  A  card  can  include: 

•  a  unique  photo  representing  the  node; 

•  a  word  cloud  summary  of  the  related  intelligence  documents  from  which  social 
network  data  were  extracted  from; 

•  snapshots  of  the  social  networks  for  various  dimensions;  this  would  be  based  on 
the  results  from  the  Graph  Analytics  widget;  and 

•  icons  showing  different  characteristics,  such  as:  the  social  entity  allegiance;  tribal 
affiliation;  criminal  or  insurgency  activities  involvements;  nationality;  religious, 
political  or  C2  known  roles. 
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A  record  browser  allows  flipping  rapidly  through  a  virtual  deck  of  summary  cards  so  that 
the  analyst  can  find  nodes  of  interest  quickly  using  visual  cues.  We  use  visual  graphical 
representations  of  the  relevant  information  instead  of  textual  descriptions  in  order  to  take 
advantage  of  human  visual  pattern  finding  abilities.  This  browser  also  allows  the  analyst 
to  select  a  particular  card  and  keep  it  on  the  left  side  of  the  display  thus  enabling  a  rapid 
visual  comparison  with  the  others  cards  of  the  deck. 

Figure  3  shows  a  mock-up  of  what  an  insurgent  card  will  look  like.  This  visualisation  is 
currently  adapted  to  the  intelligence  use-cases  in  COIN.  For  instance,  it  is  envisioned  that 
the  Summary  Card  will  support  the  intelligence  analyst  in  identifying  a  social  entity  from 
a  particular  social  network.  Such  a  social  entity  will  hold  characteristics  of  interest  and 
will  be  considered  as  a  profile  of  reference.  The  profile  of  reference  is  then  processed 
using  social  network  analysis  services  in  order  to  identify  similar  ones  either  from  the 
same  network  (the  network  of  reference)  or  from  other  networks.  The  similarity  analyses 
results  are  ranked  providing  a  list  of  promising  social  entities.  The  widget  is  then  used  to 
rapidly  scan  the  extracted  social  entities  using  the  analyst  ability  and  expertise  to  validate 
or  discard  some  of  the  social  entities  presented  on  summary  cards.  In  turn,  when 
performing  this  task,  the  analyst  can  discover  additional  patterns  of  characteristics  that 
are  associated  with  a  specific  role/position  such  as  an  attack  facilitator,  or  characteristics 
that  correspond  to  the  profile  of  an  influential  insurgent  leader.  The  analyst  can  then 
decide  to  run  a  new  similarity  analysis  based  on  this  refined  profile  of  reference. 

The  Visual  Summary  Cards  are  also  of  interest  to  increase  white  situation  awareness  by 
representing  higher  level  nodes  such  as  political  groups,  tribes  or  non-governmental 
organizations. 


Figure  3  -  Visual  Summary  Cards  in  the  Record  Browser 
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Social  networks  are,  as  mentioned  before,  composed  of  nodes  and  edges,  or  so  called 
links,  but  they  are  also  composed  of  many  attributes  characterizing  these  nodes  or  links. 
This  widget  leverages  the  notion,  also  proposed  by  other  researchers  [Perer  and 
Shneiderman  2006],  that  once  specific  SNA  metrics  are  applied  on  a  social  entity,  the 
result  can  be  attached  to  certain  nodes  and  turned  into  one  of  their  attribute  or 
characteristic.  An  example  of  this  would  be  to  calculate  a  closeness  centrality  result  to  the 
profile  of  reference  and  search  for  other  social  entities  with  similar  values  and  keeping 
records  of  the  measure  as  an  attribute  of  the  node  itself.  Currently,  most  of  SNA 
applications  permit  the  visualisation  of  the  nodes  and  the  edges  or  else  portions  of  the 
networks,  but  only  a  few  of  them  like  GraphDice  [Bezerianos  et  al  2010],  GeoSom  [Wu 
et  al  2006],  or  GraphScape  [Xu  et  al  2007]  make  an  attempt  at  visually  presenting  these 
attributes  [Jusifu  et  al  2010].  Nevertheless,  as  exposed  by  Gou  et  al.  [2012],  existing 
social  network  analysis  tools  are  usually  weak  in  supporting  complex  analytical  tasks 
involving  such  relationship  between  the  structural  (SNA  measure  like  the  closeness 
centrality)  and  the  social  data  like  some  of  the  characteristics  of  the  social  entity. 

This  widget  is  very  important  in  helping  the  analyst  to  expand  the  analysis  of  the  social 
network  from  one  node  and  its  relationships  to  the  consideration  of  other  similar  profiles 
and  patterns  in  social  networks. 

4.2  Magnets  grid  widget 

Moving  away  from  the  graph  can  help  focus  on  other  characteristics  of  the  social 
network.  For  that  purpose,  we  propose  an  extended  version  of  the  Dust  &  Magnets 
concept  from  [Soo  Yi  et  al.  2005]  for  social  networks  analysis.  The  Magnets  Grid  widget 
is  a  multi-dimensional  interactive  visualization  app  for  exploring  simultaneously  multiple 
characteristics  of  a  social  entity.  The  observation  of  multiple  properties  of  the  social 
nodes  can  lead  to  insights  about  how  they  are  correlated,  uncorrelated,  or  negatively 
correlated.  Here  again,  this  exploration  can  lead  the  analyst  to  detect  trends,  patterns  and 
outliers.  Based  on  these  discovered  trends,  the  analyst  can  subsequently  run  different 
analyses  on  selected  social  networks. 

In  Figure  4,  the  canvas  located  on  the  left  side  contains  the  dots  representing  any  type  of 
nodes/social  entity  (individuals,  groups  or  organizations).  Adding  labelled  magnets  to  the 
display  area  will  cause  the  dots  to  be  attracted  to  them  according  to  metrics  that  were 
computed  from  the  social  network  or  the  intelligence  data  gathered  about  each  node.  In 
our  extended  version,  optional  constraints  can  be  added  to  the  axes  to  keep  the  dots  inside 
columns,  rows  or  grid  boundaries. 
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Figure  4  -  Magnets  Grid  for  social  network  analysis. 


A  possible  use  of  the  Magnets  Grid  would  be  to  identify  potential  threatening  tribes  or 
individuals  that  have  been  associated  with  violent  events  in  the  past.  In  Figure  4,  for 
example,  the  dots  correspond  to  nodes  about  individuals  and  the  x  axis  is  constrained  by 
tribal  groups,  allowing  dots  to  move  only  within  the  vertical  band  where  they  belong.  The 
magnets  Government  Support  and  Insurgent  Support  were  added  to  the  canvas.  When  the 
analyst  interacts  with  a  magnet,  the  dots  move  according  to  the  metrics  that  were 
computed  for  those  magnets.  In  addition  to  colour  coding  which  was  associated  to  the 
main  role/responsibility  of  the  nodes,  the  size  of  the  dot  was  associated  with  the  number 
of  reports  about  violent  incidents  that  are  mentioning  the  individual.  The  full  power  of 
this  visual  analytic  widget  lies  in  its  interactivity  as  the  analyst  gets  a  feeling  of  the 
attraction  of  the  various  magnets  by  moving  them,  which  is  not  easily  graspable  with  a 
static  view.  However,  we  added  optional  attraction  arrows  that  can  be  turned  on  to  show 
the  force  exerted  by  each  magnets  on  selected  nodes,  thus  resolving  the  ambiguity 
surrounding  a  dot  laying  between  two  magnets  by  showing  if  it  is  equally  attracted  to 
both  or  not  attracted  at  all. 

Another  value  of  the  Magnets  Grid  will  be  to  enable  the  analyst  to  investigate  properties 
of  interest  in  order  to  gain  insights  about  existing  trends  or  patterns.  Once  the  insight  is 
gained,  the  analyst  can  more  rigorously  make  sense  of  the  situation  by  investigating,  for 
instance,  a  measure  of  assortativity  on  the  network.  Assortativity  is  the  identification  of 
selective  linkings  that  take  place  between  the  nodes  of  a  graph.  This  notion  can  be 
quantified  by  an  assortative  coefficient  [Newman,  2003  and  2003b],  Moreover,  some 
types  of  assortativity  can  also  be  characterized  based  on  node  graph  measurements  or  else 
properties;  Newman  [2003]  refers  to  such  assortativity  as  “degree  correlation”.  An 
identified  selective  linking  based  on  a  specific  property  for  instance  would  then  permit 
monitoring  the  emergence  of  favorable  conditions  of  these  linking  in  the  network  or  other 
ones. 

The  value  of  the  Magnet  Grid  widget  is  similar  to  the  Summary  Cards  ones,  but  this 
widget,  beyond  the  identification  of  trends,  opens  the  research  area  for  predictions  as  well 
as  uncovering  hidden  or  missing  data.  As  mentioned  in  Lecocq  [Lecocq  et  al.  201 1],  one 
essential  component  in  building  sensemaking  around  social  networks  is  to  consider 
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visualisation  techniques  that  enable  grasping  the  social  networks  evolution  or  predicting 
some  of  its  changes  over  time.  Change  detection  and  prediction  are  definitely  not  trivial 
areas  of  research  and  they  require  a  lot  of  caution  due  to  the  uncertainty  attached  to  any 
prediction,  or  else  the  data  set  quality  that  the  prediction  analyses  are  run  on. 

4.3  Multi-timelines  widget 

The  Multi-timelines  widget  shows  multiple  coordinated  timelines  along  with  key 
variables  to  make  sense  of  temporal  information.  Looking  at  timelines  for  different  areas, 
one  can  explore  the  effects  for  taken  actions  and  possibly  predict  what  the  outcome  of 
proposed  actions  could  be  by  comparing  timelines  from  other  areas  when  similar  actions 
were  taken.  In  Figure  5,  the  effects  of  an  operation  on  the  coalition  allegiance  from 
different  tribal  groups  are  explored.  The  changes  in  population  allegiance  are  reflected  by 
the  occurrence  of  various  positive  or  negative  events,  like  a  warm/cold  welcome  from 
local  leaders  or  the  presence/absence  of  children  greeting  the  soldiers,  which  are  recorded 
in  observations  or  reports. 
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Figure  5  -  Multi-timelines  widget  showing  the  effect  of  an  operation  on  coalition 
support  from  different  tribal  groups 

Like  in  the  Lifelines  2  application  [Wang  et  al.  2010],  the  timelines  can  be  aligned  on  a 
selected  event  type  to  analyse  repeatability  of  temporal  patterns.  In  Figure  6,  the  effects 
of  coalition  operations  over  time  are  compared  for  a  selected  tribe  over  different  time 
periods.  This  could  lead  to  findings  related  to  which  types  of  intervention  are  the  most 
effective,  or  how  long  the  forces  should  remain  in  an  area  in  order  to  gain  a  durable 
population  support  or  allegiance  to  coalition. 
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Figure  6  -  Multi-timelines  widget  allowing  the  comparison  of  the  effect  of  operations  on 
coalition  support  of  a  specific  tribe  at  different  periods  in  time 


Another  way  to  make  use  of  this  widget  is  to  compare  several  individuals’  pattern  of  life 
in  order  to  discover  trends  for  a  same  profde,  or  else  links  between  individuals.  The 
comparison  can  be  made  based  on  the  analysis  of  an  affiliation  network  between 
individuals  and  certain  time  stamped  events  or  meetings  that  can  be  aligned  temporarily. 

The  identification  and  understanding  of  any  patterns,  like  the  ones  identified  through  the 
Multi-Timelines  widget,  also  acts  as  indicators  of  potential  missing  data.  For  instance, 
these  missing  data  can  correspond  to  events  that  should  have  taken  place  while  they  were 
not  observed,  or  else  the  participation  of  a  social  entity  to  a  known  event. 

Finally,  this  widget  constitutes  an  important  building  block  to  a  SNA  capability  since  it 
takes  into  consideration  the  time  component.  Indeed,  any  attempt  to  make  predictions  or 
else  to  identify  changes  in  a  social  network  requires  the  management  of  the  time  variable. 

4.4  Graph  analytics  widget 

This  fourth  widget  is  only  being  defined  currently  and  its  development  is  expected  to  take 
place  during  the  coming  year.  This  widget  is  aligned  to  the  graph  analytics  domain  and 
this  is  where  it  takes  its  name  from.  Graph  analytics  is  a  sub-area  of  visual  analytics,  and 
is  described  by  Wong  et  al.  [2011]  as  a  “transdisciplinary  R&D  area,  involving 
information  retrieval,  data  management,  human-computer  interaction,  computer  graphics, 
and  visualization”. 

There  exist  many  different  ways  to  leverage  the  value  of  visualisation  and  visual 
analytics  for  a  SNA  capability.  However,  most  of  the  current  technologies  focus  solely  on 
visualising  networks  and  their  structure  under  the  presentation  of  a  graph  diagram 
composed  of  nodes  and  links.  Through  the  different  widgets  exposed  in  this  paper  we 
demonstrate  the  importance  of  several  other  means  than  a  graph  in  order  to  make  sense  of 
a  social  network  in  a  degraded  and  denied  environment.  Nevertheless,  the  visual 
presentation  of  a  graph  as  a  diagram  composed  of  nodes  and  links  still  bring  other  types 
of  understanding  about  the  social  network  being  studied.  In  order  to  better  analyse  and 
extract  meanings  from  SNA,  additional  visualisation  methods  need  to  complement  such 
visual  presentation.  For  instance,  Perer  and  Shneiderman  [2006,  2008,  and  2009]  very 
much  emphasize  the  need  to  combine,  on  a  same  display,  information  about  the  network 
as  a  graph  diagram  along  with  the  statistics  about  the  graphs.  This  is  how  the  “graph 
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analytics”  widget  is  viewed  since  it  will  combine  the  visual  presentation  of  the  social 
network  as  a  graph  diagram  with  the  analyses  results  that  were  performed  on  the  network, 
some  being  statistical  results.  This  perspective  is  based  on  the  results  from  researches 
demonstrating  that  combining  statistics  and  network  graphs,  involves  the  visual  as  well  as 
the  language  capacities  of  the  end-users  and  therefore  contribute  to  the  reduction  of 
cognitive  overload  [Ware  2008]. 

With  respect  to  graph  visualisation  per  se,  some  authors  are  considering  the  need  to 
provide  a  better  structure  to  the  graphs  and  data  in  order  to  understand  them  more 
adequately  and  build  sensemaking.  Peng  and  SiKun  [2009]  propose  to  use  a  domain 
ontology  model  for  the  field  of  social  network  analysis  and  to  facilitate  visualisation  of 
the  social  network.  Similarly,  this  widget  aims  at  supporting  sensemaking  as  it  goes 
beyond  the  initial  visual  information  provided  about  the  network  structure.  The  widget  is 
defined  to  connect  the  different  graph  components,  like  a  node,  a  link  or  a  property  about 
one  or  the  other,  to  a  semantic  meaning  from  an  ontology.  These  properties  are  important 
and  meaningful  to  the  analysts,  leading  them  more  easily  to  sensemaking. 

5  Discussion  and  future  research 

This  paper  describes  some  of  the  embraced  visual  analytics  concepts  in  an  applied 
research  project  undertaken  at  DRDC  Valcartier.  The  project  focuses  on  enabling  the 
development  of  a  social  network  analysis  capability  for  the  intelligence  domain. 
Developing  such  a  capability  requires  enlarging  the  research  scope  to  the  activities  to  be 
performed  prior  to  and  after  the  analysis  of  the  social  network  itself.  In  this  paper  we 
discussed  some  of  these  activities  and  how  visualisation  is  perceived  as  facilitating  them. 

Intelligence  analysis  is  composed  of  many  complex  tasks  and  is  tightly  related  to 
increasing  sensemaking.  While  automation  and  systems  can  greatly  support  the  analyst.  It 
is  critical  to  maintain  the  human  in  the  loop.  Analysts  have  a  wealth  of  experience  that 
can  be  tapped  using  advanced  visual  analytics  techniques.  Our  prototype  is  composed  of 
a  series  of  independent  but  coordinated  generic  visual  widgets  that  can  be  applied  to  a 
broad  range  of  application  domains  for  the  benefit  of  the  analyst.  Among  the  proposed 
analysis  tools  are:  a  multi -timelines  widget  for  temporal  events  and  situation  evolution 
analysis;  a  magnets  grid  widget  for  multi-dimensional  information  exploration;  and  a 
record  browser  of  summary  cards  for  fast  visual  identification  of  key  information 
elements  and  comparison  between  entities.  We  also  expose  the  concepts  underlying  an 
additional  widget  currently  in  definition.  The  Graph  Analytics  widget  combines  a  visual 
presentation  of  graph  diagrams  composed  of  nodes  and  links  to  other  visual  presentations 
of  processing  outputs  like  ranking,  statistical  results  or  else  the  semantic  meaning  of  links 
based  on  a  social  network  ontology. 

Since  the  instigation  of  the  first  three  widgets,  they  were  always  foreseen  as  being 
transitioned  to  the  SNAC  research  project;  this  is  the  effort  being  currently  conducted. 
Also,  the  fourth  widget  that  is  discussed,  the  Graph  Analytics  widget,  is  currently  under 
definition  and  its  development  is  foreseen  to  take  place  during  this  year  as  well.  Finally, 
other  additional  widgets  are  also  considered  like  the  Map  and  Timeline  widget,  which 
allows  the  user  to  interactively  view  positional  data.  Currently  this  widget,  also 
developed  for  the  maritime  domain,  enables  the  user  to  view  vessels  positions  as  well  as 
to  select  a  time  window  for  which  tracks  will  be  visible  on  the  map.  Transposition  of  this 
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widget  is  also  considered  for  the  SNAC  project  since  it  could  be  used  for  many  different 
purposes  like,  for  instance,  communication  tracking  against  insurgent  events  taking  place. 

Many  technology-driven  tools  that  are  built  pretend  to  impact  sensemaking  activities  but 
the  quantitative  or  qualitative  measure  of  such  impact  is  still  underdeveloped.  Scholtz 
[2008]  reported  progress  and  challenges  in  evaluating  tools  for  sensemaking  with  a  list  of 
metrics  resulting  from  a  workshop  discussion  for  visual  analysis  environments.  It  is  our 
plan  to  make  use  of  some  of  these  metrics  in  the  evaluation  of  the  widgets  for  the  SNAC 
project.  Meanwhile,  the  first  three  widgets  that  were  initially  developed  for  the  maritime 
domain  were  created  in  a  generic  way  and  respecting  SOA  principles.  They  were  well 
received  by  the  maritime  domain  community  and  a  more  systematic  evaluation  will  take 
place  by  the  end  of  2013. 

These  four  widgets  each  consider  some  of  the  visualization  and  visual  analytics  issues 
and  challenges  as  exposed  by  Lecocq  et  al.  [2011].  Nevertheless,  some  of  the  aspects  are 
not  yet  covered  and  will  be  part  of  future  research  on  the  topic. 
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Broadly  Applicable  Apps: 
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Future  Works 


■  Finalise  the  adaptation  of  current  generic  widgets  to  SNA  COIN  context; 

■  Develop  the  Graph  Analytics  widget; 

■  Graph  diagram  of  nodes  and  links; 

■  Statistical  outputs; 

■  Contextual  information  for  the  Intelligence  Analyst; 

■  Exploit  temporal  components. 

■  Keep  on  developing  use-cases; 

■  Instantiate  change  detection  use-cases; 

■  Investigate  other  visualisation  means  significant  to  a  SNA  capability  -  Traffic 
Density  Visualisation; 

■  Validate  current  widgets  with  real  SNA  data; 

■  Leverage  the  reasoning  services  available  on  the  SOA  platform; 

■  ... 
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